Subject: RE: SNMPv3 Diffie-Helman key mib

From: Yost William <[email-masked]>
Date: Thu, 29 Jul 1999 22:45:28 -0500

The description of usmDHKickstartMgrPublic describes how to convert the
shared secret into the underlying keys.  I believe it is better to first
convert the shared secret into a readable 16 character password and then use
the password to key algorighm in RFC2274.  This is because a lot of MIB
browsers and maybe SNMP managers do not allow manual entry of keys, only
passwords you can type in by the keyboard.  The internally they use the
password to key algorithm to make a key.

-----Original Message-----
From: Mike StJohns [mailto:[email-masked]]
Sent: Thursday, July 29, 1999 4:12 PM
To: [email-masked]
Subject: SNMPv3 Diffie-Helman key mib

I've attached the most recent spin of the document I discussed at the IETF
in 
Oslo.  This will be going out as an internet-draft as soon as I get a 
permanent OID number from the IANA for the root of the MIB. My plan is to
have 
this published as an experimental RFC unless and until I can get the SNMP v3

community to take it or something like it up and adopt it.

Mike

---

From: "Mike StJohns" <[email-masked]>
Date: Fri, 30 Jul 1999 10:57:32 -0700

> password to key algorithm to make a key.

I think you're missing the point here.  The idea is to be able to kick start this automatically, untouched by human hands.  And were talking lots and lots of values here - one per managed device.  Any manager that implements this is going to have to be able to install a key for a device based on data it can retrieve from the agent without falling back to 'printable' passwords.

BTW - I consider the ability to 'pick' a key one of the biggest weakenesses in USM.  Humans are NOT a good source of random numbers and hence are not a good source of key.

In any event, converting the shared secret into a readable password would probably involve the loss of entropy with a parallel weakening of security.  I guess you could convert the shared secret into a hex representation  -  but then why go through all of this?